The vulnerability is an uncontrolled recursion in axios’s formDataToJSON routine, exposed as axios.formToJSON() and used internally when serializing FormData with Content‑Type: application/json. When a request includes a FormData field name containing thousands of nested bracket‑delimited segments, the buildPath() helper recurses without bound, exhausting the JavaScript call stack and raising a RangeError (Maximum call stack size exceeded). This causes the offending request to fail, and in applications that do not implement sufficient error handling it can lead to process termination, effectively denying service for the affected endpoint.

The flaw affects the Axios library for Node.js. Versions 0.28.0 through 0.32.9 and 1.0.0 through 1.17.9 are vulnerable. Any JavaScript application that imports these library versions and processes user‑provided FormData with application/json content type is at risk.

The CVSS score of 6.3 indicates moderate severity. The EPSS score of <1% suggests a very low probability of exploitation in the current period, and the vulnerability is not listed in the CISA KEV catalog, indicating no known exploitation activity as of this analysis. Attackers may exploit the issue by crafting form data with deeply nested field names, a scenario that is feasible remotely from outside the application. Successful exploitation results in request failure or server crash, impairing availability of the affected services.